AWS demonstrates layering deterministic Policy checks with Lambda interceptors in the Bedrock AgentCore gateway using a lakehouse data agent to enforce geography-based controls.